Privacy Policy

Arjay Consulting Ltd ("Arjay Consulting," "we," "our," or "us") is a financial consulting firm registered in England and Wales. We operate the website arjayconsulting.co.uk and provide specialist financial advisory, CFO-level support, bookkeeping, and fundraising services to start-ups and SMEs.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Arjay Consulting Ltd is the data controller of your personal information. You can contact our data controller at rob@arjayconsulting.co.uk.

We collect and process the following categories of personal information:

Information you provide directly

• Contact details: name, email address, phone number, and business address
• Business information: company name, company number, industry, turnover, and stage of growth
• Financial data: information you share in the course of receiving our services, including financial statements, forecasts, and business plans
• Communications: messages, enquiries, and feedback submitted via our contact form or by email

Information collected automatically

• Usage data: pages visited, time spent on site, referral source, and browser interactions
• Technical data: IP address, browser type and version, device type, and operating system
• Cookie data: preferences and analytics data collected through cookies (see Section 8)

We use your personal information for the following purposes:

• To provide and deliver our financial consulting services under your engagement agreement
• To respond to your enquiries and communicate with you about our services
• To prepare proposals, engagement letters, and client onboarding documentation
• To send you relevant updates, insights, or information about our services (where you have consented or we have a legitimate interest)
• To maintain our accounts, records, and comply with legal and regulatory obligations
• To improve and maintain our website and understand how visitors use it
• To comply with anti-money laundering (AML), Know Your Customer (KYC), and other financial regulatory requirements

Under UK GDPR, we rely on the following legal bases to process your personal information:

• Contract: processing is necessary to perform our services under your engagement agreement, or to take steps at your request before entering into a contract
• Legal Obligation: processing is necessary to comply with our regulatory and legal duties, including AML and financial services regulations
• Legitimate Interests: processing is necessary for our legitimate business interests, including responding to enquiries, improving our services, and direct marketing to existing and prospective clients — where these interests are not overridden by your rights
• Consent: where we have asked for and received your explicit consent, such as for non-essential cookies or specific marketing communications

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law and regulation. Our general retention periods are:

• Client engagement records and financial data: 7 years from the end of the engagement, in line with HMRC and Companies House requirements
• AML and KYC records: 5 years from the end of the business relationship, as required under the Money Laundering Regulations 2017
• Website enquiries and contact form submissions: 2 years from the date of receipt
• Marketing communications: until you unsubscribe or withdraw consent

After the applicable retention period, personal data is securely deleted or anonymised.

We do not sell your personal information. We may share your data with third parties only in the following circumstances:

• Service providers: trusted third-party software and services we use to operate our business (e.g. accounting software, email, document management, website hosting), who are contractually bound to protect your data
• Professional advisors: lawyers, accountants, or other professional advisors where necessary to provide our services or protect our legal interests
• Regulatory authorities: HMRC, Companies House, or other public authorities where we are legally required to disclose information
• Business transfers: in the event of a merger, acquisition, or sale of business assets, your data may be transferred as part of that transaction, subject to appropriate protections

We do not transfer your personal data outside the UK or European Economic Area (EEA) without ensuring adequate protections are in place.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request that we correct inaccurate or incomplete data
• Right to erasure: to request that we delete your personal data where there is no compelling reason for us to continue processing it
• Right to restrict processing: to request that we limit the way we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to our processing of your data for legitimate interests or direct marketing purposes
• Rights related to automated decision-making: we do not use automated decision-making or profiling that has a legal or similarly significant effect on you

To exercise any of your rights, please contact us at rob@arjayconsulting.co.uk. We will respond within one month of receiving your request. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our website uses cookies to improve your browsing experience and help us understand how visitors use our site. Cookies are small text files stored on your device. We use the following types of cookies:

• Essential cookies: necessary for the website to function correctly and cannot be disabled
• Analytics cookies: help us understand visitor behaviour and improve our site (e.g. Google Analytics), collected only with your consent
• Preference cookies: remember your settings and choices to improve your experience

You can control and manage cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of our website. Our cookie banner allows you to manage your preferences when you first visit our site.

Our website may contain links to third-party websites, such as LinkedIn or partner organisations. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any third-party sites you visit.

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, loss, destruction, or alteration. These include secure data transmission (SSL/TLS), access controls, and regular security reviews.

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform you directly without undue delay.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any updates will be posted on this page with a revised 'Last Updated' date. We encourage you to review this policy periodically. Where changes are significant, we will notify you directly where we have your contact details.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• Email: rob@arjayconsulting.co.uk
• Website: arjayconsulting.co.uk/contact
• Phone: +44 (0) 7837 246 049

You may also contact the Information Commissioner's Office (ICO) if you believe your data protection rights have been breached: ico.org.uk | 0303 123 1113